Merge pull request #1029 from marty-rabens/prevent-XXE-processing

josemduarte · web-flow · commit 059fbf1403d0 · 2022-07-11T14:17:56.000-07:00
Prevent XXE (Xml eXternal Entity) injection when parsing XML data
diff --git a/biojava-core/src/main/java/org/biojava/nbio/core/util/XMLHelper.java b/biojava-core/src/main/java/org/biojava/nbio/core/util/XMLHelper.java
@@ -34,6 +34,7 @@
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
+import javax.xml.XMLConstants;
 import javax.xml.xpath.XPath;
 import javax.xml.xpath.XPathConstants;
 import javax.xml.xpath.XPathExpressionException;
@@ -105,6 +106,7 @@ public static Document inputStreamToDocument(InputStream inputStream) throws SAX
 		DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 
 		DocumentBuilder db = dbf.newDocumentBuilder();
+		dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 
 		Document doc = db.parse(inputStream);
 		doc.getDocumentElement().normalize();
